The IRB must decide on a protocol-by-protocol basis whether there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of the identifiable data at each segment of the research from recruitment to maintenance of the data.
In This Section
- What is the Requirement?
- How do I Comply with the Requirement?
- Ethical Considerations
46.111(a)(7) When appropriate, there are adequate provisions to protect the privacy of subjects and to maintain the confidentiality of data.
Initial Review Application
On the Data Confidentiality page you will be asked to confirm that only authorized persons will be granted access to the identifiers; identifiers stored on computers, electronic notebooks, mobile devices, and/or data-storage devices will be encrypted and password protected; identifiers maintained in paper format will be kept in a locked area with access limited only to research staff who require access to conduct the study. These are considered necessary protections for all human subjects research.
Describe the steps you will take to ensure subjects’ privacy is adequately protected. Privacy should be considered during all aspects of the research, including subject identification, recruitment, consent and data collection.
Describe your plan to protect the confidentiality of the research data. Protocols should be designed to minimize the need to collect and maintain identifiable information about research subjects. If possible, data should be collected anonymously or the identifiers should be removed and destroyed as soon as possible and access to research data should be based on a “need to know” and “minimum necessary” standard.
The following issues will be considered during IRB review:
- The proposed recruitment methods: How are potential participants identified and contacted? Does the recruitment plan involve access to private information, such as a medical record or student record? Where are potential subjects being approached?
- Sensitivity of the information being collected – the greater the sensitivity, the greater the need for privacy and confidentiality.
- Method of data collection (focus group, individual interview, covert observation)
- Will subjects feel comfortable providing the information in this manner?
- If passively observing the subject; could the individual have an expectation of privacy (e.g., chat room for breast cancer patients)?
- Will the researcher collect information about a third–party individual that is considered private (e.g., mental illness, substance abuse in family)? If yes, informed consent should be obtained from the third–party.
- Are the activities appropriate for the proposed subject population?
- What are the cultural norms of the proposed subject population? Some cultures are more private than others.
- What are the ages of the proposed subject population? There may be age differences in privacy preferences (e.g., teenagers less forthcoming than older adults)
- Do you have safeguards to maintain data confidentiality as described in the Initial Review Application?
- Do you plan to share data collected for research with individuals outside this institution?
- Do you plan to maintain identifiable data or specimens for future use?
Privacy is the state or condition of being free from being observed or disturbed by other people. Privacy is the control over the extent, timing, and circumstances of sharing oneself (physically, behaviorally, or intellectually) with others.
Confidentiality is the state of keeping or being kept secret or private. Confidentiality pertains to the treatment of information that an individual has disclosed in a relationship of trust and with the expectation that it will not be divulged to others without permission in ways that are inconsistent with the understanding of the original disclosure.